man > aulast(8)

AULAST(8)                          System Administration Utilities                         AULAST(8)

NAME
       aulast - a program similar to last

SYNOPSIS
       aulast [ options ]


DESCRIPTION
       aulast  is  a  program that prints out a listing of the last logged in users similarly to the
       program last and lastb. Aulast searches back through the audit logs or the  given  audit  log
       file  and  displays a list of all users logged in (and out) based on the range of time in the
       audit logs. Names of users and tty’s can be given, in which case aulast will show only  those
       entries matching the arguments.

       The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a
       log of all reboots since the log file was created.

       The  main  difference  that  a  user  will  notice is that aulast print events from oldest to
       newest, while last prints records from newest to oldest. Also, the audit system is not  noti‐
       fied each time a tty or pty is allocated, so you may not see quite as many records indicating
       users and their tty's.


OPTIONS
       --bad  Report on the bad logins.


       --debug
              Print debug messages to stderr.


       --extract
              Write  raw audit records used to create the displayed report into a file aulast.log in
              the current working directory.


       -f file
              Use the file instead of the audit logs for input.


       --proof
              Print out the audit event serial numbers used to determine the preceding line  of  the
              report.  A Serial number of 0 is a place holder and not an actual event serial number.
              The serial numbers can be used to examine the actual audit  records  in  more  detail.
              Also  an ausearch query is printed that will let you find the audit records associated
              with that session.


       --stdin
              Take audit records from stdin. The audit events must be in the raw format.


       --tty tty
              Limit the report to a specific tty's activity. The names of ttys can  be  abbreviated.
              For example, 0 is the same as tty0.


       --user name
              Limit the report to a specific user.


EXAMPLES
       To see this month's logins
       ausearch --start this-month --raw | aulast --stdin


SEE ALSO
       last(1), lastb(1), ausearch(8), aureport(8).


AUTHOR
       Steve Grubb

Red Hat                                       June 2016                                    AULAST(8)